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In the claims : The claims are changed to be as follows: 

1. (Currently amended) A system for providing an analysis of use 
in managing risk, the system comprising: 

a) a knowledge base, for maintaining a generic risk record 
including a plurality of fields at least some of which have 
values based on experience gained over time; 

b) a data store of profiles, for maintaining a profile risk 
record associated with a particular profile and including the 
same plurality of fields as the generic risk record, the profile 
risk record for use in providing a risk assessment in the 
associated profile; and 

c) a risk processor, for updating a field value of the 
generic risk record based on a corresponding field value in the 
profile risk record in the data store of profiles; 

whereby at least some of the field values of the generic 
risk record are refined over time based on values of the 
corresponding fields of the profile risk record. 

2. (Previously presented) The system of claim 1, wherein some of 
the fields in the generic risk record or the profile risk record 
are measuring fields input by the user, and others of the fields 
are calculated fields calculated by the system, and the system 
allows different modes of analysis in which the fields that are 
the measuring fields differ. 

3. (Original) The system of claim 2, wherein the modes of 
analysis include: 

a residual assessment mode, in which a user selects inherent 
values of likelihood and consequence for a risk, and a value, for 
each control for the risk, for effectiveness in either preventing 
the risk or reducing the consequence of the risk, and the system 
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then calculates residual levels of likelihood, consequence and 
risk rating for the risk; 

an inherent assessment mode, in which a user selects 
residual values of likelihood and consequence for a risk, and a 
value, for each control for the risk, for effectiveness in either 
preventing the risk or in reducing the consequence of the risk, 
and the system then calculates the inherent levels of likelihood, 
consequence and risk rating for the risk; and 

a controls self -assessment mode, in which a user selects 
inherent values of likelihood and consequence for a risk, as well 
as residual values of likelihood and consequence for the risk, 
and the system then calculates the effectiveness of predetermined 
controls needed to either prevent the risk or to reduce the 
consequence of the risk. 

4. (Previously presented) The system of claim 1, wherein the 
system can be used in different modes of use, and further wherein 
only some of the fields of the generic risk record or the profile 
risk record are required to be used in the risk management 
analysis, and which of the fields are required depends on the 
mode of use . 

5. (Previously presented) The system of claim 4, wherein both 
the generic risk record and the profile risk record each 
comprise : 

a) a risk component, for indicating a risk, for indicating 
an inherent risk rating, and also for indicating a residual risk 
rating; 

b) a cause component, for indicating the cause of the risk; 

c) a consequence component, for indicating a particular 
consequence of the risk and an inherent and a residual cost of 
the particular consequence; and 
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d) a control component, for indicating a control, for 
indicating whether the control is corrective or preventive, and 
for indicating the effectiveness of the control. 

6. (Previously presented) The system of claim 5, wherein in one 
mode of use an inherent risk impact cost is aggregated over the 
inherent cost of each consequence of the risk. 

7. (Previously presented) The system of claim 5, wherein in one 
mode of use the residual likelihood is an aggregate calculation 
based on the effectiveness of each preventive control acting on 
an inherent likelihood. 

8. (Previously presented) The system of claim 5, wherein in one 
mode of use a residual risk impact cost is aggregated over the 
residual cost of each consequence of the risk. 

9. (Original) The system of claim 1, further comprising a 
scripting facility for enabling a user to create a script 
directing how a risk management process is to be performed, the 
script indicating steps that can be used in performing risk 
analysis in any profile. 

10. (Previously presented) The system of claim 1, further 
wherein the risk processor also uses the generic risk record to 
provide initial values for the profile risk record, whereby the 
profile risk record has initial values based on experience gained 
over time. 
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